vaspera 2.14.0 → 2.15.0

package/dist/util/subprocess.js

@@ -0,0 +1,77 @@
+/**
+ * Safe subprocess execution for scanner adapters.
+ *
+ * Wraps execFile (never a shell) so argument values — project paths,
+ * target URLs, config file paths — can never be interpreted as shell
+ * syntax. This is the only sanctioned way to invoke external scanner
+ * binaries (CONSTITUTION: "No string-concat shell commands").
+ *
+ * @module util/subprocess
+ */
+import { execFile } from "child_process";
+export class CommandError extends Error {
+    binary;
+    args;
+    exitCode;
+    stdout;
+    stderr;
+    cause;
+    constructor(message, binary, args, exitCode, stdout, stderr, cause) {
+        super(message);
+        this.binary = binary;
+        this.args = args;
+        this.exitCode = exitCode;
+        this.stdout = stdout;
+        this.stderr = stderr;
+        this.cause = cause;
+        this.name = "CommandError";
+    }
+}
+/**
+ * Run a binary with discrete argv entries. No shell is ever invoked,
+ * so callers MUST NOT pre-quote values or pass shell syntax
+ * (pipes, redirects, `&&`) — restructure such logic in JS instead.
+ */
+export async function runCommand(binary, args, options = {}) {
+    const { timeout = 120000, maxBuffer = 10 * 1024 * 1024, cwd, env, tolerateExitWithOutput = true, } = options;
+    return new Promise((resolve, reject) => {
+        execFile(binary, args, { timeout, maxBuffer, cwd, env, encoding: "utf8" }, (error, stdout, stderr) => {
+            if (!error) {
+                resolve({ stdout, stderr, exitCode: 0 });
+                return;
+            }
+            const exitCode = typeof error.code === "number" ? error.code : null;
+            if (tolerateExitWithOutput &&
+                exitCode !== null &&
+                !error.killed &&
+                stdout &&
+                stdout.length > 0) {
+                resolve({ stdout, stderr: stderr || "", exitCode });
+                return;
+            }
+            const reason = error.killed
+                ? `timed out after ${timeout}ms`
+                : exitCode !== null
+                    ? `exited with code ${exitCode}`
+                    : `failed to start (${error.code ?? error.message})`;
+            reject(new CommandError(`${binary} ${reason}${stderr ? `: ${stderr.slice(0, 500)}` : ""}`, binary, args, exitCode, stdout ?? "", stderr ?? "", error));
+        });
+    });
+}
+/**
+ * Probe for a scanner binary by running it with a version-style flag.
+ * Returns the first line of stdout (trimmed) or null when unavailable.
+ */
+export async function probeBinary(binary, args = ["--version"], timeout = 5000) {
+    try {
+        const { stdout } = await runCommand(binary, args, {
+            timeout,
+            tolerateExitWithOutput: false,
+        });
+        return stdout.trim().split("\n")[0] ?? null;
+    }
+    catch {
+        return null;
+    }
+}
+//# sourceMappingURL=subprocess.js.map

package/dist/util/subprocess.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"subprocess.js","sourceRoot":"","sources":["../../src/util/subprocess.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,QAAQ,EAA0B,MAAM,eAAe,CAAC;AAEjE,MAAM,OAAO,YAAa,SAAQ,KAAK;IAGnB;IACA;IACA;IACA;IACA;IACA;IAPlB,YACE,OAAe,EACC,MAAc,EACd,IAAc,EACd,QAAuB,EACvB,MAAc,EACd,MAAc,EACd,KAAa;QAE7B,KAAK,CAAC,OAAO,CAAC,CAAC;QAPC,WAAM,GAAN,MAAM,CAAQ;QACd,SAAI,GAAJ,IAAI,CAAU;QACd,aAAQ,GAAR,QAAQ,CAAe;QACvB,WAAM,GAAN,MAAM,CAAQ;QACd,WAAM,GAAN,MAAM,CAAQ;QACd,UAAK,GAAL,KAAK,CAAQ;QAG7B,IAAI,CAAC,IAAI,GAAG,cAAc,CAAC;IAC7B,CAAC;CACF;AAwBD;;;;GAIG;AACH,MAAM,CAAC,KAAK,UAAU,UAAU,CAC9B,MAAc,EACd,IAAc,EACd,UAA6B,EAAE;IAE/B,MAAM,EACJ,OAAO,GAAG,MAAM,EAChB,SAAS,GAAG,EAAE,GAAG,IAAI,GAAG,IAAI,EAC5B,GAAG,EACH,GAAG,EACH,sBAAsB,GAAG,IAAI,GAC9B,GAAG,OAAO,CAAC;IAEZ,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,QAAQ,CACN,MAAM,EACN,IAAI,EACJ,EAAE,OAAO,EAAE,SAAS,EAAE,GAAG,EAAE,GAAG,EAAE,QAAQ,EAAE,MAAM,EAAE,EAClD,CAAC,KAA+B,EAAE,MAAc,EAAE,MAAc,EAAE,EAAE;YAClE,IAAI,CAAC,KAAK,EAAE,CAAC;gBACX,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,EAAE,CAAC,CAAC;gBACzC,OAAO;YACT,CAAC;YAED,MAAM,QAAQ,GAAG,OAAO,KAAK,CAAC,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;YAEpE,IACE,sBAAsB;gBACtB,QAAQ,KAAK,IAAI;gBACjB,CAAC,KAAK,CAAC,MAAM;gBACb,MAAM;gBACN,MAAM,CAAC,MAAM,GAAG,CAAC,EACjB,CAAC;gBACD,OAAO,CAAC,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,IAAI,EAAE,EAAE,QAAQ,EAAE,CAAC,CAAC;gBACpD,OAAO;YACT,CAAC;YAED,MAAM,MAAM,GAAG,KAAK,CAAC,MAAM;gBACzB,CAAC,CAAC,mBAAmB,OAAO,IAAI;gBAChC,CAAC,CAAC,QAAQ,KAAK,IAAI;oBACjB,CAAC,CAAC,oBAAoB,QAAQ,EAAE;oBAChC,CAAC,CAAC,oBAAoB,KAAK,CAAC,IAAI,IAAI,KAAK,CAAC,OAAO,GAAG,CAAC;YAEzD,MAAM,CACJ,IAAI,YAAY,CACd,GAAG,MAAM,IAAI,MAAM,GAAG,MAAM,CAAC,CAAC,CAAC,KAAK,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,GAAG,CAAC,EAAE,CAAC,CAAC,CAAC,EAAE,EAAE,EACjE,MAAM,EACN,IAAI,EACJ,QAAQ,EACR,MAAM,IAAI,EAAE,EACZ,MAAM,IAAI,EAAE,EACZ,KAAK,CACN,CACF,CAAC;QACJ,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;AACL,CAAC;AAED;;;GAGG;AACH,MAAM,CAAC,KAAK,UAAU,WAAW,CAC/B,MAAc,EACd,OAAiB,CAAC,WAAW,CAAC,EAC9B,OAAO,GAAG,IAAI;IAEd,IAAI,CAAC;QACH,MAAM,EAAE,MAAM,EAAE,GAAG,MAAM,UAAU,CAAC,MAAM,EAAE,IAAI,EAAE;YAChD,OAAO;YACP,sBAAsB,EAAE,KAAK;SAC9B,CAAC,CAAC;QACH,OAAO,MAAM,CAAC,IAAI,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,IAAI,IAAI,CAAC;IAC9C,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "vaspera",
-  "version": "2.14.0",
+  "version": "2.15.0",
   "packageManager": "npm@10.2.4",
   "files": [
     "dist",
@@ -38,7 +38,7 @@
     "claude"
   ],
   "scripts": {
-    "build": "npm run generate:manifest && tsc",
+    "build": "tsc && npm run generate:manifest",
     "build:mcp": "tsc",
     "start": "node dist/index.js",
     "start:http": "node dist/http-server.js",
@@ -53,6 +53,12 @@
     "profile": "npx tsx scripts/profile.ts",
     "generate:manifest": "npx tsx scripts/generate-manifest.ts",
     "self-certify": "npm run generate:manifest && npx tsx scripts/self-certify.ts",
+    "constitution": "npx tsx scripts/constitution-check.ts",
+    "emit:cert": "npx tsx scripts/emit-sample-certificate.ts",
+    "verify:cert": "npx tsx scripts/verify-certificate.ts",
+    "benchmark": "npx tsx scripts/run-benchmark.ts",
+    "benchmark:llm": "npx tsx scripts/run-llm-benchmark.ts",
+    "benchmark:redteam": "npx tsx scripts/run-redteam-benchmark.ts",
     "test:self": "npm run self-certify",
     "release-notes": "npx tsx scripts/release-notes.ts",
     "changeset": "changeset",
@@ -76,6 +82,9 @@
     "yaml": "~2.9.0",
     "zod": "^3.24.0"
   },
+  "overrides": {
+    "shell-quote": "~1.8.4"
+  },
   "devDependencies": {
     "@changesets/changelog-github": "^0.5.0",
     "@changesets/cli": "^2.27.0",
@@ -86,6 +95,7 @@
     "@vitest/coverage-v8": "~4.1.4",
     "concurrently": "^9.1.2",
     "fast-check": "~4.8.0",
+    "openai": "~6.42.0",
     "turbo": "~2.9.6",
     "vitest": "~4.1.4"
   }

package/dist/eval/fixtures/healthcare/audit-gaps.d.ts

@@ -1,28 +0,0 @@
-/**
- * Test Fixture: Audit Gaps
- *
- * This file contains intentional audit trail gaps that should be
- * detected by the healthcare scanner. Used for testing only.
- *
- * EXPECTED FINDINGS:
- * - PHI access without audit log (high)
- * - Missing user ID in audit entries (medium)
- * - Audit log without timestamp (medium)
- *
- * @module eval/fixtures/healthcare/audit-gaps
- */
-export declare function readPatientRecord(patientId: string, userId: string): Promise<{}>;
-export declare function updateMedicalRecord(patientId: string, updates: object): Promise<{
-    success: boolean;
-}>;
-export declare function viewPatientData(patientId: string): Promise<{
-    id: string;
-    name: string;
-}>;
-export declare function deletePatientData(patientId: string, userId: string): Promise<boolean>;
-export declare function clearAuditLogs(adminId: string): Promise<void>;
-export declare function properAuditedAccess(patientId: string, userId: string): Promise<{
-    id: string;
-    name: string;
-}>;
-//# sourceMappingURL=audit-gaps.d.ts.map

package/dist/eval/fixtures/healthcare/audit-gaps.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-gaps.d.ts","sourceRoot":"","sources":["../../../../src/eval/fixtures/healthcare/audit-gaps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,eAIxE;AAGD,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM;;GAI3E;AAGD,wBAAsB,eAAe,CAAC,SAAS,EAAE,MAAM;;;GAQtD;AAGD,wBAAsB,iBAAiB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,oBAQxE;AAGD,wBAAsB,cAAc,CAAC,OAAO,EAAE,MAAM,iBAGnD;AAqBD,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;GA0B1E"}

package/dist/eval/fixtures/healthcare/audit-gaps.js

@@ -1,90 +0,0 @@
-/**
- * Test Fixture: Audit Gaps
- *
- * This file contains intentional audit trail gaps that should be
- * detected by the healthcare scanner. Used for testing only.
- *
- * EXPECTED FINDINGS:
- * - PHI access without audit log (high)
- * - Missing user ID in audit entries (medium)
- * - Audit log without timestamp (medium)
- *
- * @module eval/fixtures/healthcare/audit-gaps
- */
-// PHI access without audit logging - SHOULD BE DETECTED
-export async function readPatientRecord(patientId, userId) {
-    // No audit log call before or after PHI access
-    const patient = await database.query(`SELECT * FROM patients WHERE id = ?`, [patientId]);
-    return patient;
-}
-// Another missing audit log - SHOULD BE DETECTED
-export async function updateMedicalRecord(patientId, updates) {
-    await database.query(`UPDATE patients SET ? WHERE id = ?`, [updates, patientId]);
-    // No audit trail for this modification
-    return { success: true };
-}
-// Missing user ID in audit - SHOULD BE DETECTED
-export async function viewPatientData(patientId) {
-    await auditLog.write({
-        action: "view_patient",
-        resourceId: patientId,
-        // Missing: userId
-        timestamp: new Date().toISOString(),
-    });
-    return await fetchPatient(patientId);
-}
-// Audit log without timestamp - SHOULD BE DETECTED
-export async function deletePatientData(patientId, userId) {
-    await auditLog.write({
-        action: "delete_patient",
-        userId: userId,
-        resourceId: patientId,
-        // Missing: timestamp
-    });
-    return await database.delete("patients", patientId);
-}
-// Deletable audit log - SHOULD BE DETECTED
-export async function clearAuditLogs(adminId) {
-    // Audit logs should be immutable
-    await database.query("DELETE FROM audit_logs WHERE created_at < ?", [thirtyDaysAgo()]);
-}
-// Simulated database and audit
-const database = {
-    query: async (sql, params) => ({}),
-    delete: async (table, id) => true,
-};
-const auditLog = {
-    write: async (entry) => true,
-};
-function thirtyDaysAgo() {
-    return new Date(Date.now() - 30 * 24 * 60 * 60 * 1000).toISOString();
-}
-async function fetchPatient(id) {
-    return { id, name: "Test Patient" };
-}
-// This is OK - proper audit trail
-export async function properAuditedAccess(patientId, userId) {
-    // Log before access
-    await auditLog.write({
-        action: "phi_access",
-        userId: userId,
-        resourceType: "patient",
-        resourceId: patientId,
-        timestamp: new Date().toISOString(),
-        ipAddress: "127.0.0.1",
-        outcome: "pending",
-    });
-    const patient = await fetchPatient(patientId);
-    // Log after access with outcome
-    await auditLog.write({
-        action: "phi_access",
-        userId: userId,
-        resourceType: "patient",
-        resourceId: patientId,
-        timestamp: new Date().toISOString(),
-        outcome: "success",
-        dataAccessed: ["name", "dob", "mrn"],
-    });
-    return patient;
-}
-//# sourceMappingURL=audit-gaps.js.map

package/dist/eval/fixtures/healthcare/audit-gaps.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"audit-gaps.js","sourceRoot":"","sources":["../../../../src/eval/fixtures/healthcare/audit-gaps.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,wDAAwD;AACxD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACvE,+CAA+C;IAC/C,MAAM,OAAO,GAAG,MAAM,QAAQ,CAAC,KAAK,CAAC,qCAAqC,EAAE,CAAC,SAAS,CAAC,CAAC,CAAC;IACzF,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,iDAAiD;AACjD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,OAAe;IAC1E,MAAM,QAAQ,CAAC,KAAK,CAAC,oCAAoC,EAAE,CAAC,OAAO,EAAE,SAAS,CAAC,CAAC,CAAC;IACjF,uCAAuC;IACvC,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,CAAC;AAC3B,CAAC;AAED,gDAAgD;AAChD,MAAM,CAAC,KAAK,UAAU,eAAe,CAAC,SAAiB;IACrD,MAAM,QAAQ,CAAC,KAAK,CAAC;QACnB,MAAM,EAAE,cAAc;QACtB,UAAU,EAAE,SAAS;QACrB,kBAAkB;QAClB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;KACpC,CAAC,CAAC;IACH,OAAO,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;AACvC,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,iBAAiB,CAAC,SAAiB,EAAE,MAAc;IACvE,MAAM,QAAQ,CAAC,KAAK,CAAC;QACnB,MAAM,EAAE,gBAAgB;QACxB,MAAM,EAAE,MAAM;QACd,UAAU,EAAE,SAAS;QACrB,qBAAqB;KACtB,CAAC,CAAC;IACH,OAAO,MAAM,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,SAAS,CAAC,CAAC;AACtD,CAAC;AAED,2CAA2C;AAC3C,MAAM,CAAC,KAAK,UAAU,cAAc,CAAC,OAAe;IAClD,iCAAiC;IACjC,MAAM,QAAQ,CAAC,KAAK,CAAC,6CAA6C,EAAE,CAAC,aAAa,EAAE,CAAC,CAAC,CAAC;AACzF,CAAC;AAED,+BAA+B;AAC/B,MAAM,QAAQ,GAAG;IACf,KAAK,EAAE,KAAK,EAAE,GAAW,EAAE,MAAkB,EAAE,EAAE,CAAC,CAAC,EAAE,CAAC;IACtD,MAAM,EAAE,KAAK,EAAE,KAAa,EAAE,EAAU,EAAE,EAAE,CAAC,IAAI;CAClD,CAAC;AAEF,MAAM,QAAQ,GAAG;IACf,KAAK,EAAE,KAAK,EAAE,KAAa,EAAE,EAAE,CAAC,IAAI;CACrC,CAAC;AAEF,SAAS,aAAa;IACpB,OAAO,IAAI,IAAI,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,EAAE,GAAG,IAAI,CAAC,CAAC,WAAW,EAAE,CAAC;AACvE,CAAC;AAED,KAAK,UAAU,YAAY,CAAC,EAAU;IACpC,OAAO,EAAE,EAAE,EAAE,IAAI,EAAE,cAAc,EAAE,CAAC;AACtC,CAAC;AAED,kCAAkC;AAClC,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB,EAAE,MAAc;IACzE,oBAAoB;IACpB,MAAM,QAAQ,CAAC,KAAK,CAAC;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,MAAM;QACd,YAAY,EAAE,SAAS;QACvB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,SAAS,EAAE,WAAW;QACtB,OAAO,EAAE,SAAS;KACnB,CAAC,CAAC;IAEH,MAAM,OAAO,GAAG,MAAM,YAAY,CAAC,SAAS,CAAC,CAAC;IAE9C,gCAAgC;IAChC,MAAM,QAAQ,CAAC,KAAK,CAAC;QACnB,MAAM,EAAE,YAAY;QACpB,MAAM,EAAE,MAAM;QACd,YAAY,EAAE,SAAS;QACvB,UAAU,EAAE,SAAS;QACrB,SAAS,EAAE,IAAI,IAAI,EAAE,CAAC,WAAW,EAAE;QACnC,OAAO,EAAE,SAAS;QAClB,YAAY,EAAE,CAAC,MAAM,EAAE,KAAK,EAAE,KAAK,CAAC;KACrC,CAAC,CAAC;IAEH,OAAO,OAAO,CAAC;AACjB,CAAC"}

package/dist/eval/fixtures/healthcare/consent-bypass.d.ts

@@ -1,31 +0,0 @@
-/**
- * Test Fixture: Consent Bypass
- *
- * This file contains intentional consent validation bypass patterns that
- * should be detected by the healthcare scanner. Used for testing only.
- *
- * EXPECTED FINDINGS:
- * - Always-true consent check (high)
- * - Missing consent validation in PHI access (high)
- * - Consent check commented out (high)
- *
- * @module eval/fixtures/healthcare/consent-bypass
- */
-export declare function hasConsent(): boolean;
-export declare function checkConsentStatus(): boolean;
-export declare function accessPatientRecord(patientId: string): Promise<{
-    id: string;
-    medicalHistory: never[];
-    ssn: string;
-}>;
-export declare function getPatientMedicalHistory(patientId: string): Promise<never[]>;
-export declare function getSUDTreatmentPlan(patientId: string): Promise<{
-    patientId: string;
-    treatmentPlan: string;
-}>;
-export declare function properConsentCheck(patientId: string, userId: string): Promise<{
-    id: string;
-    medicalHistory: never[];
-    ssn: string;
-}>;
-//# sourceMappingURL=consent-bypass.d.ts.map

package/dist/eval/fixtures/healthcare/consent-bypass.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"consent-bypass.d.ts","sourceRoot":"","sources":["../../../../src/eval/fixtures/healthcare/consent-bypass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,wBAAgB,UAAU,IAAI,OAAO,CAEpC;AAGD,wBAAgB,kBAAkB,IAAI,OAAO,CAG5C;AAGD,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM;;;;GAK1D;AAGD,wBAAsB,wBAAwB,CAAC,SAAS,EAAE,MAAM,oBAI/D;AAGD,wBAAsB,mBAAmB,CAAC,SAAS,EAAE,MAAM;;;GAI1D;AAYD,wBAAsB,kBAAkB,CAAC,SAAS,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM;;;;GAMzE"}

package/dist/eval/fixtures/healthcare/consent-bypass.js

@@ -1,61 +0,0 @@
-/**
- * Test Fixture: Consent Bypass
- *
- * This file contains intentional consent validation bypass patterns that
- * should be detected by the healthcare scanner. Used for testing only.
- *
- * EXPECTED FINDINGS:
- * - Always-true consent check (high)
- * - Missing consent validation in PHI access (high)
- * - Consent check commented out (high)
- *
- * @module eval/fixtures/healthcare/consent-bypass
- */
-// Always-true consent check - SHOULD BE DETECTED
-export function hasConsent() {
-    return true; // BUG: Always returns true without validation
-}
-// Another always-true pattern - SHOULD BE DETECTED
-export function checkConsentStatus() {
-    const consentGiven = true;
-    return consentGiven; // BUG: Hard-coded consent
-}
-// Consent check commented out - SHOULD BE DETECTED
-export async function accessPatientRecord(patientId) {
-    // if (!await checkConsentStatus()) {
-    //   throw new Error("Consent not given");
-    // }
-    return fetchPatientData(patientId);
-}
-// Missing consent validation before PHI access - SHOULD BE DETECTED
-export async function getPatientMedicalHistory(patientId) {
-    // No consent check before accessing sensitive data
-    const patient = await fetchPatientData(patientId);
-    return patient.medicalHistory;
-}
-// Missing consent check with SUD data - SHOULD BE DETECTED
-export async function getSUDTreatmentPlan(patientId) {
-    // SUD data requires explicit consent under 42 CFR Part 2
-    // but no consent validation here
-    return await fetchSUDRecords(patientId);
-}
-// Helper functions (simulated)
-async function fetchPatientData(patientId) {
-    return { id: patientId, medicalHistory: [], ssn: "123-45-6789" };
-}
-async function fetchSUDRecords(patientId) {
-    return { patientId, treatmentPlan: "Methadone maintenance" };
-}
-// This is OK - proper consent check
-export async function properConsentCheck(patientId, userId) {
-    const consent = await validateConsent(patientId, userId);
-    if (!consent.valid) {
-        throw new Error("Patient consent not obtained");
-    }
-    return await fetchPatientData(patientId);
-}
-async function validateConsent(patientId, userId) {
-    // Real implementation would check database
-    return { valid: false, scope: [], expiresAt: null };
-}
-//# sourceMappingURL=consent-bypass.js.map

package/dist/eval/fixtures/healthcare/consent-bypass.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"consent-bypass.js","sourceRoot":"","sources":["../../../../src/eval/fixtures/healthcare/consent-bypass.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,iDAAiD;AACjD,MAAM,UAAU,UAAU;IACxB,OAAO,IAAI,CAAC,CAAC,8CAA8C;AAC7D,CAAC;AAED,mDAAmD;AACnD,MAAM,UAAU,kBAAkB;IAChC,MAAM,YAAY,GAAG,IAAI,CAAC;IAC1B,OAAO,YAAY,CAAC,CAAC,0BAA0B;AACjD,CAAC;AAED,mDAAmD;AACnD,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,qCAAqC;IACrC,0CAA0C;IAC1C,IAAI;IACJ,OAAO,gBAAgB,CAAC,SAAS,CAAC,CAAC;AACrC,CAAC;AAED,oEAAoE;AACpE,MAAM,CAAC,KAAK,UAAU,wBAAwB,CAAC,SAAiB;IAC9D,mDAAmD;IACnD,MAAM,OAAO,GAAG,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;IAClD,OAAO,OAAO,CAAC,cAAc,CAAC;AAChC,CAAC;AAED,2DAA2D;AAC3D,MAAM,CAAC,KAAK,UAAU,mBAAmB,CAAC,SAAiB;IACzD,yDAAyD;IACzD,iCAAiC;IACjC,OAAO,MAAM,eAAe,CAAC,SAAS,CAAC,CAAC;AAC1C,CAAC;AAED,+BAA+B;AAC/B,KAAK,UAAU,gBAAgB,CAAC,SAAiB;IAC/C,OAAO,EAAE,EAAE,EAAE,SAAS,EAAE,cAAc,EAAE,EAAE,EAAE,GAAG,EAAE,aAAa,EAAE,CAAC;AACnE,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB;IAC9C,OAAO,EAAE,SAAS,EAAE,aAAa,EAAE,uBAAuB,EAAE,CAAC;AAC/D,CAAC;AAED,oCAAoC;AACpC,MAAM,CAAC,KAAK,UAAU,kBAAkB,CAAC,SAAiB,EAAE,MAAc;IACxE,MAAM,OAAO,GAAG,MAAM,eAAe,CAAC,SAAS,EAAE,MAAM,CAAC,CAAC;IACzD,IAAI,CAAC,OAAO,CAAC,KAAK,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAClD,CAAC;IACD,OAAO,MAAM,gBAAgB,CAAC,SAAS,CAAC,CAAC;AAC3C,CAAC;AAED,KAAK,UAAU,eAAe,CAAC,SAAiB,EAAE,MAAc;IAC9D,2CAA2C;IAC3C,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC;AACtD,CAAC"}

package/dist/eval/fixtures/healthcare/phi-in-logs.d.ts

@@ -1,24 +0,0 @@
-/**
- * Test Fixture: PHI in Logs
- *
- * This file contains intentional PHI exposure patterns that should be
- * detected by the healthcare scanner. Used for testing only.
- *
- * EXPECTED FINDINGS:
- * - SSN in log output (critical)
- * - MRN in console.log (critical)
- * - Patient data in error logs (high)
- *
- * @module eval/fixtures/healthcare/phi-in-logs
- */
-export declare function logPatientInfo(patientId: string, ssn: string): void;
-export declare function logMedicalRecordAccess(mrn: string, action: string): void;
-export declare function handlePatientError(error: Error, patientSSN: string): void;
-export declare function debugPatientRecord(patient: {
-    name: string;
-    ssn: string;
-    mrn: string;
-}): void;
-export declare function logMedicationDispense(patientId: string, medication: string): void;
-export declare function logGenericMessage(message: string): void;
-//# sourceMappingURL=phi-in-logs.d.ts.map

package/dist/eval/fixtures/healthcare/phi-in-logs.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"phi-in-logs.d.ts","sourceRoot":"","sources":["../../../../src/eval/fixtures/healthcare/phi-in-logs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAGH,wBAAgB,cAAc,CAAC,SAAS,EAAE,MAAM,EAAE,GAAG,EAAE,MAAM,QAE5D;AAGD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAGjE;AAGD,wBAAgB,kBAAkB,CAAC,KAAK,EAAE,KAAK,EAAE,UAAU,EAAE,MAAM,QAElE;AAGD,wBAAgB,kBAAkB,CAAC,OAAO,EAAE;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAA;CAAE,QAErF;AAGD,wBAAgB,qBAAqB,CAAC,SAAS,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,QAI1E;AAGD,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,QAEhD"}

package/dist/eval/fixtures/healthcare/phi-in-logs.js

@@ -1,41 +0,0 @@
-/**
- * Test Fixture: PHI in Logs
- *
- * This file contains intentional PHI exposure patterns that should be
- * detected by the healthcare scanner. Used for testing only.
- *
- * EXPECTED FINDINGS:
- * - SSN in log output (critical)
- * - MRN in console.log (critical)
- * - Patient data in error logs (high)
- *
- * @module eval/fixtures/healthcare/phi-in-logs
- */
-// SSN in logger output - SHOULD BE DETECTED
-export function logPatientInfo(patientId, ssn) {
-    console.log(`Processing patient ${patientId} with SSN: ${ssn}`);
-}
-// MRN exposure in logs - SHOULD BE DETECTED
-export function logMedicalRecordAccess(mrn, action) {
-    console.log(`MRN ${mrn}: ${action}`);
-    console.info(`Medical record MRN: ${mrn} accessed`);
-}
-// PHI in error message - SHOULD BE DETECTED
-export function handlePatientError(error, patientSSN) {
-    console.error(`Failed to process patient. SSN: ${patientSSN}, Error: ${error.message}`);
-}
-// Patient data in debug logs - SHOULD BE DETECTED
-export function debugPatientRecord(patient) {
-    console.debug(`Patient record: ${JSON.stringify(patient)}`);
-}
-// SUD medication in logs - SHOULD BE DETECTED
-export function logMedicationDispense(patientId, medication) {
-    if (medication.toLowerCase().includes("methadone") || medication.toLowerCase().includes("suboxone")) {
-        console.log(`Dispensed ${medication} to patient ${patientId}`);
-    }
-}
-// This is OK - no PHI in logs
-export function logGenericMessage(message) {
-    console.log(message);
-}
-//# sourceMappingURL=phi-in-logs.js.map

package/dist/eval/fixtures/healthcare/phi-in-logs.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"phi-in-logs.js","sourceRoot":"","sources":["../../../../src/eval/fixtures/healthcare/phi-in-logs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AAEH,4CAA4C;AAC5C,MAAM,UAAU,cAAc,CAAC,SAAiB,EAAE,GAAW;IAC3D,OAAO,CAAC,GAAG,CAAC,sBAAsB,SAAS,cAAc,GAAG,EAAE,CAAC,CAAC;AAClE,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,sBAAsB,CAAC,GAAW,EAAE,MAAc;IAChE,OAAO,CAAC,GAAG,CAAC,OAAO,GAAG,KAAK,MAAM,EAAE,CAAC,CAAC;IACrC,OAAO,CAAC,IAAI,CAAC,uBAAuB,GAAG,WAAW,CAAC,CAAC;AACtD,CAAC;AAED,4CAA4C;AAC5C,MAAM,UAAU,kBAAkB,CAAC,KAAY,EAAE,UAAkB;IACjE,OAAO,CAAC,KAAK,CAAC,mCAAmC,UAAU,YAAY,KAAK,CAAC,OAAO,EAAE,CAAC,CAAC;AAC1F,CAAC;AAED,kDAAkD;AAClD,MAAM,UAAU,kBAAkB,CAAC,OAAmD;IACpF,OAAO,CAAC,KAAK,CAAC,mBAAmB,IAAI,CAAC,SAAS,CAAC,OAAO,CAAC,EAAE,CAAC,CAAC;AAC9D,CAAC;AAED,8CAA8C;AAC9C,MAAM,UAAU,qBAAqB,CAAC,SAAiB,EAAE,UAAkB;IACzE,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,UAAU,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,UAAU,CAAC,EAAE,CAAC;QACpG,OAAO,CAAC,GAAG,CAAC,aAAa,UAAU,eAAe,SAAS,EAAE,CAAC,CAAC;IACjE,CAAC;AACH,CAAC;AAED,8BAA8B;AAC9B,MAAM,UAAU,iBAAiB,CAAC,OAAe;IAC/C,OAAO,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC;AACvB,CAAC"}